rule Jbifrost
{
	meta:
		author = " Kevin Breen <kevin@techanarchy.net>"
		date = "2018/02"
		maltype = "Remote Access Trojan"
		filetype = "Java"

    strings:
        $meta = "META-INF"
 		$a1 = "config.json"
		$a2 = "Key1.json"
		$a3 = "Key2.json"
		$b1 = "sky.drive"
		$b2 = "mega.download"
		$b3 = "drop.box"
		$c = "sq/d.png"

    condition:
       $meta and (all of ($a*) or all of ($b*) or $c)
}
